Privacy Policy
What Beflow Decisions collects, why, who processes it with us, how long we keep it, and the choices you have.
Last updated October 13, 2026
Draft — this document is being reviewed by our lawyers and may change before it takes effect.
Who we are
Beflow Decisions is operated by [company legal name], [registered address] (“Beflow”, “we”). For questions about this policy or your data, write to the address on our Contact page.
For the business data your organization brings into Beflow Decisions, your organization is the controller and Beflow processes it on your organization’s behalf. For the account and website data described below, Beflow is the controller.
What we collect
- Account data: your name, work email, job title, password (stored only as a hash), preferences, and two-step sign-in settings.
- Organization data: your company’s name, industry, size, country, currency and settings, and the members you invite.
- Business data you bring in: the books and reports you connect from QuickBooks Online or upload — customers, vendors, invoices, bills, payments, products and accounts — and what Beflow calculates from them.
- Usage and security data: sign-ins, sessions (browser, device, approximate location), the audit log of administrative actions, and technical logs.
- Billing data: your plan, invoices and the brand, last four digits and expiry of your card. Card numbers are handled by Stripe and never reach us.
- Messages you send us.
Why we use it
- To provide the service: calculating your KPIs, Business Health Score, AI analysis, recommendations, missions and reports.
- To keep it secure: authentication, preventing abuse, investigating incidents, and keeping the audit log.
- To bill for it, and to send the emails the service needs (verification, invitations, password resets, reports and summaries you choose).
- To keep it working and improve it, from aggregated usage and error data.
- [Legal bases for each purpose, where the law requires them — to be completed by counsel.]
AI processing
Your figures are calculated by Beflow’s own engine. To write explanations and prioritise recommendations, a summary of those figures is sent to our AI provider, Anthropic. Customer and product names are replaced with stand-ins before they leave our servers. Our provider does not use this data to train its models.
Who processes data with us
We use these service providers, each only for the purpose shown:
- Supabase — database and file storage (United States).
- Hostinger — servers that run the application.
- Stripe — payments and invoices.
- Anthropic — AI analysis, with names replaced as described above.
- Intuit — the QuickBooks Online connection, at your organization’s direction.
- Resend — sending email.
- Sentry and Grafana Labs — error and performance monitoring.
- [Backup storage provider] — encrypted backups.
- We do not sell personal data, and we do not share it for advertising.
How long we keep it
- Your organization’s data, for as long as its account is open, then [period] after it closes.
- Ended sessions for 30 days; expired sign-in and reset tokens for 7 days.
- Backups for up to 12 months, encrypted.
- The audit log for [period].
- Billing records as long as the law requires.
Security
How we protect data is described on our Security page.
Your choices and rights
- You can see and correct your profile at any time, and export reports and the audit log.
- Owners can remove members and delete their organization.
- Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to object to its use. Write to us to exercise them; we will answer within the time the law sets.
- [Complaints to a supervisory authority, and any region-specific rights — to be completed by counsel.]
International transfers
Some of our providers process data in the United States. [Transfer safeguards — to be completed by counsel.]
Changes
If we change this policy we will update the date above and, for significant changes, tell account owners by email before they take effect.